[Splunk DB Connect] Resolving "Error: Certificates Do Not Conform to Algorithm Constraints" When Saving Connection

Applicability

Description

When attempting to save a connection in Splunk DB Connect, the following error message may be encountered:

"encrypt" property is set to "false" and "trustServerCertificate" property is set to "false" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: Certificates do not conform to algorithm constraints.

This article explains the potential causes of this error and provides step-by-step solutions to resolve the issue and successfully establish a secure connection.

Investigation

During the investigation, it was determined that the connection in Splunk DB Connect could not be saved, and the following error was consistently encountered:

"encrypt" property is set to "false" and "trustServerCertificate" property is set to "false" but the driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption: Error: Certificates do not conform to algorithm constraints.

Several troubleshooting steps were performed to resolve the issue:

1. JDBC String Modifications:
   The following parameters were added to the connection string in an attempt to resolve the error:

   trustServerCertificate=true; authenticationScheme=NTLM

   Despite these changes, the issue persisted.

2. Error Logging Investigation:
   Detailed error messages were checked on the search head using the following SPL:

   index=_internal host=instance_name *connection_name* ERROR

   However, no specific errors related to the algorithm causing the issue were found in the logs.

3. Testing with Crypto-Policy Modifications:
   As part of further troubleshooting, the /etc/crypto-policies/back-ends/java.config file was examined, and the following entries were removed:

   RSA 2048 and SHA1withRSA from jdk.certpath.disabledAlgorithms

   After saving the changes and restarting the Splunk service, the issue remained unresolved.

Resolution

It was found that after changing the RSA key size from 2048 bits to 1024 bits, DB Connect began functioning as expected. The issue arose because DB Connect relies on Java for database communication, and Java imposes certain restrictions on encryption algorithms.
When Java 11 is installed, some encryption algorithms—such as RSA with a 2048-bit key size—are disabled by default in the java.security file. If a service attempts to use a disabled algorithm, like the one employed by the default Splunk certificate, communication fails.
By adjusting the RSA key size to 1024 bits, the issue was resolved, as this key size is supported by the default Java 11 settings.

To resolve the issue, the following steps were performed:

1. The file /etc/crypto-policies/back-ends/java.config was navigated to.
2. The RSA key size was changed from 2048 to 1024.
3. The Splunk service was restarted.

After completing these steps, the connection was successfully saved, and the issue was resolved.